Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-90010

scsi: bsg: Cap io_uring sense copy to max_response_len

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to < 5d326efc334ea21afd8161f6ca53e17de71948a9affected
  • 7b6d3255e7f8c6df2d21504c47808e3ce84649ac to < ece06de726737e887dc0225c8283477624f8ae21affected

Linux Linux

Default version status: affected

  • 7.1affected
  • 0 to < 7.1unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References